Skip to main content
Deployment

Deploy SSL/TLS Certificates in Docker NGINX Containers

Mount certificate files, configure NGINX, and automate renewal for a Docker deployment.

CertOne3 min read

Containerized NGINX needs access to certificate files and the correct TLS configuration. This guide covers mounts, configuration, and renewal.

1. Preparation​

1. Obtain an SSL/TLS certificate​

Before deployment, prepare:

  • A certificate issued through CertOne, Let's Encrypt, or another provider
  • A certificate file (.crt or .pem)
  • A private key file (.key)
  • An intermediate certificate chain file, when required

2. Prepare Docker​

  • Install Docker
  • Pull an NGINX image
  • Understand basic Docker operations

2. Prepare certificate files​

1. Create a certificate directory​

mkdir -p /path/to/ssl

2. Copy certificate files​

# Copy the certificate files.
cp certificate.crt /path/to/ssl/
cp private.key /path/to/ssl/
cp chain.crt /path/to/ssl/

3. Set file permissions​

chmod 644 /path/to/ssl/certificate.crt
chmod 600 /path/to/ssl/private.key
chmod 644 /path/to/ssl/chain.crt

3. NGINX configuration​

1. Create the configuration​

Create nginx.conf:

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/certificate.crt;
    ssl_certificate_key /etc/nginx/ssl/private.key;
    ssl_trusted_certificate /etc/nginx/ssl/chain.crt;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    
    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

2. Create a Dockerfile (optional)​

FROM nginx:alpine

COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY ssl/ /etc/nginx/ssl/

EXPOSE 80 443

4. Run the container​

1. With docker run​

docker run -d \
  --name nginx-ssl \
  -p 80:80 \
  -p 443:443 \
  -v /path/to/ssl:/etc/nginx/ssl:ro \
  -v /path/to/nginx.conf:/etc/nginx/conf.d/default.conf:ro \
  nginx:alpine

2. With Docker Compose​

Create docker-compose.yml:

version: '3'

services:
  nginx:
    image: nginx:alpine
    container_name: nginx-ssl
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./ssl:/etc/nginx/ssl:ro
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
    restart: unless-stopped

Start the container:

docker-compose up -d

5. Automate deployment with CertOne​

1. Create a deployment node​

  1. Sign in to CertOne
  2. Open Deployment nodes
  3. Click Create deployment node
  4. Select Docker → NGINX

2. Configure deployment​

  1. Configure the container for the selected deployment method
  2. Set the certificate path or mount
  3. Configure the service reload command
  4. Test the connection

3. Associate a certificate​

  1. Select the certificate to deploy
  2. Select the deployment node
  3. Enable automatic deployment
  4. Renewed certificates will be deployed to the container

6. Automatic renewal​

1. Renew automatically with CertOne​

  1. Enable auto-renewal in the certificate settings
  2. Configure deployment to the Docker container
  3. Reload or restart the service after the certificate is replaced

2. Script-based renewal​

Create an update script, update-cert.sh:

#!/bin/bash

# Download the replacement certificate.
# Insert your certificate download command here.

# Copy the certificate files.
cp new_certificate.crt /path/to/ssl/certificate.crt
cp new_private.key /path/to/ssl/private.key

# Restart the container.
docker restart nginx-ssl

Verify the configuration​

1. Check container status​

docker ps | grep nginx-ssl

2. Check HTTPS access​

  1. Visit https://your-domain.com
  2. Inspect the browser's connection security indicator
  3. Confirm the certificate details

3. Inspect container logs​

docker logs nginx-ssl

8. Common issues​

1. Certificate permissions​

Problem: the container cannot read the certificate files.

Resolution:

  • Check file permissions
  • Use a read-only :ro mount where appropriate
  • Check ownership

2. Renewal does not take effect​

Problem: the container still serves the old certificate.

Resolution:

  • Reload the service or restart the container
  • Confirm that the mounted certificate files were updated
  • Use CertOne automatic deployment

3. Port conflicts​

Problem: port 80 or 443 is already in use.

Resolution:

  • Identify the process using the port
  • Adjust port mappings
  • Stop the conflicting service if appropriate

Best practices​

1. Certificate management​

  • ✅ Use CertOne automatic deployment
  • ✅ Back up certificate files regularly
  • ✅ Monitor certificate expiration

2. Container configuration​

  • ✅ Use read-only mounts where appropriate
  • ✅ Configure restart policies
  • ✅ Add health checks

3. Security configuration​

  • ✅ Use secure TLS protocols
  • ✅ Configure security response headers
  • ✅ Limit container privileges

Conclusion​

Correct certificate mounts and NGINX configuration enable HTTPS in Docker. Plan renewal and service reloads together.

Key points:

  • ✅ Make certificate files available in the container
  • ✅ Configure NGINX TLS
  • ✅ Use CertOne automatic deployment
  • ✅ Automate certificate renewal

CertOne supports deployment to Docker containers, helping automate certificate issuance and management.